JP4783392B2 - Information processing apparatus and failure recovery method - Google Patents

Description

  The present invention relates to an information processing apparatus having a virtual storage function and a failure recovery method applied to the apparatus.

  Due to recent improvements in semiconductor technology, systems that support virtualization of hardware resources such as CPUs and I / O devices have been developed. This system is controlled by virtualization software called a virtual machine monitor (hypervisor).

  As virtualization software, commercial software VMware (registered trademark) and open source software Xen are well known.

  By using these virtualization software, a virtual environment can be easily constructed on a computer such as a personal computer.

  By using this virtual environment, a plurality of operating systems can simultaneously use hardware resources such as a CPU, a memory, and an I / O device, and the hardware resources can be effectively used.

  However, in the field of virtualization technology, there are few reports on how to implement a fault-tolerant function for increasing system availability.

  2. Description of the Related Art Conventionally, in a computer system such as a server that requires high reliability, as a method for avoiding a hardware failure such as a memory or a CPU or a system stop due to a software failure, an OS is installed on a server on which hardware devices are multiplexed. A method of operating, a method of operating in a system in which a plurality of computers are clustered using clustering software, and the like are used.

  However, in the method of multiplexing hardware devices, the hardware cost increases and it is difficult to cope with a system stop due to a software defect. In addition, special software such as a device driver for controlling the hardware device is required.

  On the other hand, in the case of a method that uses clustering software to operate a system in which a plurality of computers are clustered, it is necessary to prepare a plurality of computers and clustering software, which increases the time and cost related to system construction. There is a problem.

Incidentally, Patent Document 1 discloses a data recovery method in a virtual storage management computer. This method turns off the writable bit in the page table, generates a memory protection interrupt when the processor attempts to update the page data, and saves the contents of the page to disk in the interrupt handling routine. That's it.
JP-A-10-78884

  However, in the method of Patent Document 1, high reliability of a computer system having a virtualization function is not considered. In addition, since the method of Patent Document 1 only considers data recovery of a certain program, there is a risk that a system stop cannot be avoided when a hardware failure or software failure actually occurs.

  In a computer system having a virtualization function, hardware resources are managed by virtualization software. Therefore, in order to achieve high reliability, a new system between an operating system operating in a virtual environment and virtualization software is required. It is necessary to implement an interface.

  The present invention has been made in consideration of the above-described circumstances, and can avoid a system stop due to a hardware failure or a software failure without using a complicated configuration such as hardware multiplexing or clustering. And it aims at providing a failure recovery method.

In order to solve the above-described problem, the present invention provides an information processing apparatus that has a virtualization function and a virtual storage function and processes virtual storage of an operating system operating on a virtual environment in units of pages. Means for setting all pages of a page table corresponding to a memory area allocated to the operating system to a write-inhibited state by a virtual machine monitor to be controlled, and the operating system refers to the page table to access a write-protected page; In response to a page write violation exception that occurs when the page write violation occurs, the pre-update data of the page in which the page write violation has occurred is acquired from the memory area of the operating system and stored in the memory area managed by the virtual machine monitor Processing the virtual machine monitor Therefore, the pre-update data storage means to be executed, and writing to the page where the page write violation has occurred by the operating system by releasing the write prohibition of the page where the page write violation has occurred after storing the pre-update data Means for executing the process to be continued by the virtual machine monitor;
Checkpoint acquisition means for periodically executing checkpoint acquisition processing and storing a context including a state of a processor of the information processing apparatus in a memory area corresponding to a predetermined virtual page address of the operating system; and the page When an exception due to a write violation occurs, a process for determining whether or not the page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address, and the page in which the page write violation has occurred is the predetermined If it is determined that the page corresponds to the virtual page address of the page, the page for which the write prohibition has been canceled is set to the write prohibition state again, and all the pages of the page table allocated to the operating system are reset to the write prohibition state. Processing to perform the virtual machine Characterized by comprising a means for performing the monitoring.

  The present invention also provides a failure recovery processing method for recovering an information processing apparatus having a virtualization function and a virtual storage function from a failure, and an operating system that operates in a virtual environment controlled by a virtual machine monitor. A step of executing a process of setting all pages of a page table corresponding to a memory area to be allocated to a write-protected state by a virtual machine monitor that controls the virtual environment; and the page for the operating system to access a page that is write-protected. A memory area managed by the virtual machine monitor by acquiring pre-update data of the page in which the page write violation occurred from the memory area of the operating system in response to an exception of the page write violation that occurs when referring to the table The process of saving in the virtual machine A step of executing by the monitor, and a process of continuing to write to the page in which the page write violation has occurred by releasing the write prohibition of the page in which the page write violation has occurred after storing the pre-update data Are executed by the virtual machine monitor, and a checkpoint acquisition process is periodically executed, and a context including the state of the processor of the information processing apparatus is stored in a memory corresponding to a predetermined virtual page address of the operating system. A checkpoint acquisition step for storing in an area, and a process for determining whether or not a page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address when an exception due to the page write violation occurs When it is determined that the page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address, the page for which the write prohibition is canceled is again set to the write prohibition state and assigned to the operating system. And a step of executing, by the virtual machine monitor, a process of resetting all pages of the page table to a write-inhibited state.

  The present invention also provides a program that functions as a virtual machine monitor that virtualizes hardware resources of a computer having a virtual storage function, and that is allocated to an operating system that operates in a virtual environment controlled by the virtual machine monitor. Responding to a procedure for setting all pages of the page table corresponding to the area to the write-protected state and a page write violation exception that occurs when the operating system references the page table to access the write-protected page. A pre-update data storage procedure for executing processing for acquiring pre-update data of a page in which the page write violation has occurred from a memory area of the operating system and storing the pre-update data in a memory area managed by the virtual machine monitor; Save previous data A procedure for executing a process of continuing to write to the page where the page write violation occurred by the operating system by releasing the write prohibition of the page where the page write violation occurred later, and an exception due to the page write violation occurs A determination procedure for determining whether or not the page in which the page write violation has occurred is a page corresponding to a predetermined virtual page address of the operating system, and the operating system periodically acquires a checkpoint A determination procedure including a task for executing a process and storing a context including a state of a processor of the information processing apparatus in a memory area corresponding to the predetermined virtual page address; and an exception due to the page write violation if it occurs, A procedure for determining whether or not a page in which a page write violation has occurred is a page corresponding to the predetermined virtual page address; and a page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address. If it is determined that there is, the computer executes a procedure for setting the page for which the write prohibition is canceled to the write prohibition state again and resetting all the pages of the page table assigned to the operating system to the write prohibition state. It is characterized by making it.

  According to the present invention, it is possible to avoid a system stop due to a hardware failure or software failure without using a complicated configuration such as hardware multiplexing or clustering.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, the configuration of an information processing apparatus according to an embodiment of the present invention will be described with reference to FIG. This information processing apparatus is a computer using an existing PC architecture such as the IA architecture, and is realized as a server computer for executing various business processes, for example.

  FIG. 1 schematically shows the configuration of the computer. As shown, the computer includes one or more CPUs (processors) 111, a memory management unit (MMU) 112, a memory 113 composed of one or more memory modules, and a disk such as a hard disk drive (HDD). A drive device 114 and other various I / O devices 115 such as a graphics controller and a LAN controller are provided. The memory management unit (MMU) 112 is connected to the memory 113, the disk drive device 114, and the I / O device 115 via the system bus 100.

  The memory management unit (MMU) 112 is a mechanism for supporting a virtual storage function, and converts a virtual storage address of an operating system operating on a virtual environment (virtual machine) into a physical address by paging. The memory management unit (MMU) 112 may be mounted in the CPU 111. As a configuration example of the multiprocessor configuration, a configuration using one CPU 111 including a plurality of cores, a configuration using a plurality of CPUs 111, and the like can be used.

  In this computer, a virtual machine monitor, which is virtualization software that virtualizes hardware resources such as a CPU and an I / O device and operates an existing operating system in the virtual environment, is executed. This virtual machine monitor processes virtual memory of an operating system operating in a virtual environment in units of pages and controls real hardware resources.

  FIG. 2 shows the relationship between the hardware and software of this computer.

  Control of hardware resources (real hardware) such as the CPU 111, the memory 113, the disk drive device 114, and other I / O devices 115 are all executed by the virtual machine monitor (hypervisor) 200. The virtual machine monitor 200 provides a virtual environment (virtual machine) to each operating system (guest OS). That is, the virtual machine monitor 200 virtualizes hardware resources and allocates logical hardware resources to each guest OS. As a result, a plurality of guest OSs can operate independently on the virtual environment provided for each guest OS on the virtual machine monitor 200.

  FIG. 3 shows an example of the virtual storage function of the computer. The virtual storage function is a function that converts the virtual address space (virtual storage space) into a physical address space (physical memory space) in units of pages of a predetermined size using paging. A page table is used for this address conversion. The MMU 112 is provided with a translation lookaside buffer (TLB), and the contents of the page table are cached.

  FIG. 3 shows an example of memory management in units of pages in the x86 CPU (in the case of 32-bit addressing). When the CPU 111 accesses certain data in the virtual address space, the virtual address (32 bits) of the data is composed of, for example, a page directory index, a page table index, and a page offset. The page directory entry (PDE) in the page directory (PD) specified by the CR3 register of the CPU is specified by the page directory index in the virtual address. The value of the designated page directory entry (PDE) designates a page table corresponding to the virtual address from among a plurality of page tables (PT). The page table index in the virtual address specifies a page table entry (PTE) in the specified page table. The value of this page table entry (PTE) indicates the address of the physical page on the physical memory corresponding to the virtual address. In this physical page, an address specified by a page offset in the virtual address is a physical address corresponding to the virtual address. The validity / invalidity of each page table entry (PTE) in the page table (PT) identifies whether a physical page corresponding to the virtual space address accessed by the CPU exists on the physical memory 113.

  Thus, the page table (PT) is used to convert a virtual page address into a physical page address.

  FIG. 4 shows an example of memory allocation used in this embodiment.

  In the present embodiment, on the memory space of the physical memory 113, the memory area 301 for the guest OS1, the memory area 302 for the guest OS2, the memory area 303 for the guest OS3, and the memory for the virtual machine monitor (hypervisor) An area 304, an update history memory area 305 of the guest OS1, an update history memory area 306 of the guest OS2, an update history memory area 307 of the guest OS3, and a failure replacement memory area 308 for the guest OS1 to OS3 are allocated. Yes.

  For example, the guest OS 1 can access the memory area 301 for the guest OS 1 using the virtual address space (0 to 2 GB), and the guest OS 2 is used for the guest OS 2 using the virtual address space (0 to 1 GB). The memory area 302 can be accessed.

  The update history memory area 305 of the guest OS 1 is an area for storing a memory update history performed by the guest OS 1. In this area, data before update of the data in the memory area 301 updated by the guest OS 1 is virtual. Accumulated by the machine monitor 200.

  The update history memory area 306 of the guest OS 2 is an area for storing a memory update history performed by the guest OS 2. In this area, data before update of the data in the memory area 302 updated by the guest OS 2 is virtual. Accumulated by the machine monitor 200.

  The update history memory area 307 of the guest OS 3 is an area for storing the memory update history performed by the guest OS 3, and here, the pre-update data of the data on the memory area 303 updated by the guest OS 3 is virtual. Accumulated by the machine monitor 200.

  These update history memory areas 305 to 307 are memory areas managed by the virtual machine monitor 200.

  The failure replacement memory area 308 is a storage area used for replacement of a storage location when a hardware failure occurs at a storage location in the physical memory area allocated to the guest OS. This fault replacement memory area 308 is also a memory area managed by the virtual machine monitor 200.

  Here, an outline of the pre-update data accumulation process executed by the virtual machine monitor 200 will be described. Here, in order to simplify the description, a case where there is one guest OS is illustrated.

  The virtual machine monitor 200 sets all pages in the page table corresponding to the memory area allocated to the guest OS to a write-protected state. For example, the bit indicating the writable attribute of each page table entry may be set off. When the guest OS refers to the page table to access a write-protected page, a page write violation exception (or interrupt) is generated in the CPU, which gives control to the virtual machine monitor 200. In response to the occurrence of the page write violation exception, the virtual machine monitor 200 acquires the pre-update data of the page in which the page write violation has occurred from the memory area of the guest OS, and the update history memory area for the guest OS Save to.

  After saving the pre-update data, the virtual machine monitor 200 continues to write to the page where the page write violation has occurred by the guest OS by releasing the write prohibition of the page where the page write violation has occurred. As a result, the guest OS can normally execute writing to the page.

  By accumulating the pre-update data in the update history memory area in this way, the contents of the guest OS memory area can be restored using the update history memory area.

  The pre-update data storage process is controlled to synchronize with the timing of the checkpoint acquisition process. Here, the checkpoint acquisition process is a process of periodically storing information necessary for re-execution from a state in the middle of process execution. The time when this information is stored is called a checkpoint, and the storage of this information is called checkpoint acquisition. In the checkpoint acquisition process, the context including the CPU state (program counter, register value, etc.) is saved as information necessary for re-execution. This checkpoint acquisition process can be executed by the guest OS kernel. In this case, the guest OS stores the acquired context in a memory area corresponding to a predetermined virtual page address of the guest OS. The virtual machine monitor 200 can control the pre-update data storage process triggered by a write to a virtual page address used for checkpoint acquisition.

  That is, when an exception due to a page writing violation occurs, the virtual machine monitor 200 first determines whether or not the page where the page writing violation has occurred is a page corresponding to the virtual page address for checkpoint acquisition. The page specified by the virtual page address for acquiring the checkpoint is used as a page for an interface between the guest OS and the virtual machine monitor 200.

  If the page in which the page write violation has occurred is a page corresponding to the virtual page address for checkpoint acquisition, the virtual machine monitor 200 sets the page for which the write prohibition has been canceled to the write prohibition state again, whereby the guest OS Reset all pages in the page table to be assigned to write-protected state.

  In this way, every page in the page table is initially set to a write-protected state at each checkpoint, and during the period from one checkpoint to the next checkpoint, each page is updated for the first time. Only the corresponding pre-update data is accumulated.

  The virtual machine monitor 200 executes access to the I / O device so as to synchronize with the timing of the checkpoint acquisition process.

  That is, the virtual machine monitor 200 accumulates the I / O request issued from the guest OS in order to delay the execution timing of the I / O request issued from the guest OS until the next checkpoint acquisition process is executed. To do. The virtual machine monitor 200 accumulates when it is determined that the page where the page write violation has occurred is a page corresponding to the virtual page address for checkpoint acquisition, that is, when the checkpoint acquisition processing is executed. The I / O request being executed.

  By delaying the execution of the I / O request in this way, when a failure occurs, not only the state of the CPU and memory but also the state of the I / O device can be restored to the state at the time of the previous checkpoint. I can do it.

  Since the virtual machine monitor 200 directly controls all hardware resources, the timing at which an I / O request by the guest OS is actually executed can be easily controlled.

  In addition, the virtual machine monitor 200 executes the following processing when a hardware failure occurs. Here, an ECC error of the memory 112 will be described as an example.

  When an ECC error occurs, an NMI (interrupt) occurs and control is passed to the virtual machine monitor 200.

  The virtual machine monitor 200 determines whether or not the generated ECC error is an error correctable error (1 bit error). When the generated ECC error is not an error correctable error (2-bit error), the virtual machine monitor 200 changes the CPU state to the state corresponding to the immediately preceding checkpoint using the saved context (checkpoint information). At the same time, the pre-update data stored in the update history memory area is used to restore the state of the guest OS memory area to the time corresponding to the immediately preceding checkpoint.

  Furthermore, the virtual machine monitor 200 allocates a free physical page in the fault replacement memory area 308 to a virtual page address where an error that is not error-correctable has occurred, and assigns a virtual page address that has an error that is not error-correctable. The page address of the free physical page is set in the corresponding page table entry.

  The virtual machine monitor 200 also has the following functions in order to avoid a system stop due to a software defect.

  First, the virtual machine monitor 200 initializes the page table in a state where there is no page corresponding to the virtual page address at which the guest OS calls the panic function. When the guest OS refers to the page table in order to call the panic function, an exception due to a page fault occurs, and thereby control is transferred to the virtual machine monitor 200. In response to the occurrence of an exception due to a page fault, the virtual machine monitor 200 determines whether or not the page in which the page fault has occurred is a page corresponding to a virtual page address that calls a panic function code.

  If the page corresponds to the virtual page address that calls the panic function code, the virtual machine monitor 200 changes the CPU state to the state corresponding to the immediately preceding checkpoint using the saved context (checkpoint information). At the same time, the pre-update data stored in the update history memory area is used to restore the state of the guest OS memory area to the time corresponding to the immediately preceding checkpoint.

  Next, specific processing executed by the virtual machine monitor 200 will be described.

  First, page fault processing by the virtual machine monitor will be described. Here, in order to facilitate understanding of the configuration example of the present embodiment, first, a general virtual machine monitor will be described using Xen as an example.

  In the virtual machine Minita Xen, a shadow page table for converting the virtual space address of the guest OS and the physical memory separately from the page table (guest page table) which is a data structure for managing the paging function of the virtual space address of the guest OS An address conversion method using is generally used. The guest page table managed by the guest OS is virtual in terms of address conversion, and each entry in the guest page table stores an address that the guest OS thinks is a physical page address. The shadow page table is a real page table that is actually set in the MMU 112, and is managed by the virtual machine minita Xen. Each entry of the shadow page table stores an actual physical page address.

  FIG. 5 is a conceptual diagram of the shadow page table of the virtual machine monitor Xen.

  In order to simplify the explanation, here, a single shadow page table is used for explanation. In order to distinguish between the guest OS and the virtual machine monitor, S (shadow) is added to the term on the shadow side. This is for explanation, and in Xen, PT is the page table of the page virtual monitor, which corresponds to the SPT described here. The multiple shadow page table is a method having a shadow page table for each page table (guest page table) of each guest OS, and each time the guest OS page table is switched, the corresponding shadow page table is switched back. .

  When the guest OS is executed, the CPU (genuine, not virtual) refers to the shadow page table (SPT) of the virtual machine monitor instead of the page table of the guest OS and performs address conversion. In the case of IA32, it is necessary to always execute the invlpg instruction in order to flush the TLB. In a CPU in which virtualization is implemented, a general protection exception occurs, and control is passed to the virtual machine monitor that processes the exception.

The virtual machine monitor Xen manages the occurrence of a guest OS PTE operation by a page fault. For this reason, the SPTE of the SPT of the physical memory to which the PTE of the PT of the guest OS is mapped is invalidated. When a page fault exception occurs in the guest OS PTE operation, the page is queued in a list called out of sync list and SPTE of the virtual machine monitor mapped to the guest OS PTE is enabled (recover exception). ), Allowing the guest OS to write to the PTE, write to the PTE, and execute the invlpg instruction when updating the PTE.

  When an invlpg instruction (privileged instruction) is executed, a general protection exception occurs, control is passed to the virtual machine monitor, the contents of the out of sync list are reflected in the SPT, and the virtual machine monitor Xen mapped to the PTE of the guest OS Disable SPTE again.

  When the guest OS tries to add a PTE to the PT in order to access the page, the CPU accesses via the SPD. Therefore, since the SPTE does not exist in the SPT, the address cannot be converted, and a page fault occurs. In the virtual machine monitor that processes the page fault, the virtual space address that processes the fault saves the PT of the guest OS in the out of sync list and resolves the page fault. When the invlpg instruction is executed to solve the page fault, update the PTE of the guest OS PT, and flush the TLB, a general protection exception occurs, control is passed to the virtual machine monitor, and it is saved in the out of sync list Check the PTE status of the current PT and the PTE status of the current guest OS, and if there is no PT PTE of the current guest OS and there is a PT PTE saved in the out of sync list Determines that the PTE of the guest OS has become invalid, and invalidates the PT PTE of the virtual machine monitor. If there is a PT PTE for the current guest OS and there is no PT PTE saved in the out of sync list, it is determined that the guest OS has set the PTE, and the guest OS PTE is copied to the SPTE. (FIG. 5).

  Up to this point, an example of realizing a page fault in the virtual machine monitor Xen is described.

  In the present embodiment, for example, in addition to the shadow page table of the conventional virtual machine monitor, the SPTE of the SPT of the physical memory to which all the PTs of the guest OS are mapped is prohibited. In Xen, in order to emulate the PTE operation of the PT of the guest OS, the shadow page table, the out of sync list, and the write back by the general protection exception of the invlpg instruction executed by the guest OS are used. Then, in order to save the page state before updating the guest OS, a before page image list is added to the memory management structure of the virtual machine monitor.

In the present embodiment, SPTE is referred to when the guest OS updates a page. In SPTE, each page corresponding to all PTEs is set to write-protection, so a page fault exception (exception due to write violation) occurs, and control is passed to the virtual machine monitor 200. In the virtual machine monitor 200, if SPTE is write-protected,
(First writing between checkpoints) The contents of the page to be updated by the guest OS (data before update) are stored in the update history memory area corresponding to the guest OS shown in FIG. 2 and the guest OS is to be updated. Set the virtual space address of the page (virtual address of the guest OS) and the address of the update history memory area (physical address of the virtual machine monitor) in the shadow page table entry list, and correspond to the page where the write violation occurred The SPTE write prohibition is canceled (FIG. 6).

  The method for saving each guest OS in the update history memory area in FIG. 2 is to search before page image entry by the virtual space address (virtual page address) of the guest OS in which the page fault has occurred, and if a page fault has occurred If the entry of the virtual space address of the guest OS is valid, the before image has been collected in the past, so the corresponding entry in the update history is overwritten with the virtual space address data of the guest OS. If the entry is invalid, the before image has not been collected in the past, so write the virtual space address data of the guest OS to the corresponding entry in the update history, and extract the entry that is invalid for the before page image entry Then, the virtual space address of the guest OS is set and the entry is validated (FIG. 8).

  In this embodiment, an ECC error page list is also used as shown in FIG. This ECC error page list is used for linking pages in which an ECC 2-bit error has occurred. In this embodiment, as shown in FIG. 7, an I / O request list is also added as an I / O request management structure for accumulating and managing I / O requests from the guest OS.

  Next, the flow of page fault processing executed by the virtual machine monitor 200 will be described with reference to the flowcharts of FIGS. 9 and 10.

  First, whether the page write by the guest OS is within the range of the virtual address managed by the guest OS is determined by the MMU of the CPU or the like (step S11). Is written by the virtual machine monitor 200 (step S12).

  If the page write is within the virtual address range managed by the guest OS and the write page is write-protected (YES in step S13), a page write violation exception occurs and the virtual machine monitor 200 Control passes to.

  The virtual machine monitor 200 determines whether or not the page in which the page write violation has occurred is not the above-described interface page (checkpoint acquisition page) between the guest OS and the virtual machine monitor 200, that is, a page write violation has occurred. It is determined whether or not the page is a page corresponding to the virtual page address of the guest OS to which the context is to be written for checkpoint acquisition (step S14).

  If the page in which the page write violation has occurred is not an interface page (checkpoint acquisition page) (YES in step S14), the virtual machine monitor 200 displays the content (data) before the update of the page in which the page write violation has occurred. Are read from the memory area of the guest OS and stored in the update history memory area corresponding to the guest OS (step S15). After the saving, the virtual machine monitor 200 updates the page table and sets the page to be writable (step S16). As a result, the guest OS can write data to the page where the page write violation has occurred (step S17).

  If the page in which the page write violation has occurred is an interface page (a checkpoint acquisition page) (NO in step S14), the virtual machine monitor 200 sets the interface page to be writable, and then step S21. Proceed to Execute an unissued I / O request that exists in the I / O management structure. Then, the virtual machine monitor 200 initializes data for managing a page having a page fault existing in the memory management structure (step S22), and then sets writing of all pages to write prohibition again (step S23). . The checkpoint information (context) is written on the checkpoint acquisition page by the guest OS (step S17).

  Next, the flow of general protection exception processing with the invlpg instruction will be described with reference to the flowchart of FIG.

  When the invlpg instruction is executed, the virtual machine monitor 200 determines whether the page for the interface between the guest OS and the virtual machine monitor 200 is writable (step S21). If the interface page is writable (YES in step S31), the virtual machine monitor 200 prohibits writing the page (step S32). Then, the virtual machine monitor 200 synchronizes the page table and the shadow page table using the out of sync list (step S33).

  Next, the flow of NMI processing when an ECC error occurs will be described with reference to the flowcharts of FIGS.

  When a failure such as an ECC 2-bit error occurs, NMI (Non Maskable Interrupt) is input to the CPU. Since the CPU's NMI handler interrupt is registered in the virtual machine monitor 200, the virtual machine monitor 200 processes the NMI. In the virtual machine monitor 200, processing for executing a checkpoint restart is added in addition to the conventional NMI handler. The processing of the NMI handler at the time of an ECC error is as follows.

  When an ECC error occurs due to memory access by the guest OS, control is passed to the virtual machine monitor 200 by the NMI. The virtual machine monitor 200 determines whether or not the generated ECC error is an error correctable ECC error (step S41).

  If the error is not an error-correctable ECC error (NO in step S41), the virtual machine monitor 200 restores the memory state of the guest OS to the time corresponding to the immediately preceding checkpoint using the stored pre-update data. The process which performs is performed (step S42). In step S42, for example, using the update history management structure (before page image list), the contents of the memory corresponding to the virtual address of the guest OS are written back to the physical address except for the virtual address that is not error-correctable. Next, the virtual machine monitor 200 prepares a free physical page in the fault replacement memory area 308 for the virtual page address where an error that is not error-correctable has occurred (step S43). Then, the virtual machine monitor 200 sets the page address of the prepared free physical page in the entry of the page table (shadow page table) corresponding to the virtual page address where an error that is not error correctable has occurred (steps S44 to S46). ). In this case, the pre-update data corresponding to the virtual page address where an error that is not error-correctable has occurred is written back to the prepared free physical page (step S44).

  Thereafter, the virtual machine monitor 200 displays a message indicating that an ECC error has occurred on a display screen such as a console (step S47).

  If the generated ECC error is an ECC error that cannot be corrected, the restart process may be automatically started. In this case, a process for restoring the memory state of the guest OS to the time corresponding to the immediately preceding checkpoint using the stored pre-update data, and a free physical for the virtual page address in which an error that is not error-correctable has occurred. In addition to processing to set the physical page address of the physical page prepared in the entry of the page table corresponding to the virtual page address where the error occurred that is not error correctable, in addition to using the stored context The virtual machine monitor 200 executes processing for restoring the CPU state to the state corresponding to the immediately preceding checkpoint.

  In addition, the virtual machine monitor 200 performs the same processing as that for the ECC error on the panic function of the guest OS.

  The occurrence of panic can be easily monitored by, for example, initializing the page table in a state where there is no page corresponding to the virtual page address at which the guest OS calls the panic function. The procedure is as follows.

  1. First, the virtual machine monitor 200 initializes the page table in a state where there is no page corresponding to the virtual page address at which the guest OS calls the panic function. Here, for example, the present bit of the page table entry corresponding to the virtual page address that calls the panic function is set to OFF.

  2. When an exception due to a page fault occurs, the virtual machine monitor 200 determines whether or not the page in which the page fault has occurred is a page corresponding to a virtual page address that calls a panic function code.

  3. If the page corresponds to the virtual page address that calls the panic function code, the virtual machine monitor 200 restores the CPU state to the state corresponding to the immediately preceding checkpoint using the saved context (checkpoint information). At the same time, the pre-update data stored in the update history memory area is used to restore the state of the guest OS memory area to the time corresponding to the immediately preceding checkpoint.

  In the case of using a database or the like, it is also meaningful to enable recovery in accordance with a request from a user (application). In this case, if a “restart” interface page is set, the restart can be realized by a user request.

  Next, a process for acquiring a checkpoint will be described.

  The checkpoint acquisition process can be realized in the guest OS kernel. In the case of Windows (registered trademark), it can be realized by a kernel driver, and in the case of Linux (registered trademark), it can be realized by a kernel thread. The kernel thread binds to the logical CPU of the guest OS, and operates for the number of CPUs at the same time, and one of the representatives acquires a checkpoint using inter-CPU communication.

  The flowchart in FIG. 14 shows the flow of checkpoint acquisition processing.

  For example, a plurality of guest OSs communicate with each other using inter-CPU communication to determine a representative from among the guest OSs (step S51). Each guest OS determines whether or not it is a representative at each checkpoint time. If it is not a representative, it waits until the checkpoint acquisition process is completed (steps S52 and S53). The representative guest OS executes the checkpoint acquisition process by writing the checkpoint information (context) in the page for interface with the virtual machine monitor (steps S53 and S54).

  As described above, according to the present embodiment, by accumulating the pre-update data in the update history memory area, the contents of the memory area of the guest OS can be restored using the update history memory area. Further, the pre-update data accumulation process is controlled to synchronize with the timing of the checkpoint acquisition process by using a page for the interface between the guest OS and the virtual monitor. As a result, every page of the page table can be initialized to a write-protected state every time a checkpoint is acquired, and during the period from one checkpoint to the next checkpoint, the first Only pre-update data corresponding to the update can be efficiently accumulated. Further, by using the interface page between the guest OS and the virtual monitor, a process for delaying the execution timing of the I / O request issued from the guest OS until the next checkpoint acquisition process is executed. Since it can be executed efficiently, the state of the entire system including the I / O device can be normally returned to the previous checkpoint and restarted.

  Therefore, it is possible to avoid a system stop due to hardware failure or software failure on a computer using the virtualization function without using a complicated configuration such as hardware multiplexing or clustering.

  In this embodiment, an example in which a page table for holding a physical page address managed by the virtual machine monitor in addition to the guest page table has been described as a shadow page table, but this is only an example, The configuration may be such that only the page table for converting the virtual page address of the guest OS into the physical page address managed by the virtual machine monitor is used.

  In addition, since the pre-update data storage process and the failure recovery process of this embodiment are all executed by the virtual machine monitor, the virtual machine monitor is simply installed and executed on a normal computer through a computer-readable storage medium. The effects similar to those of the present embodiment can be easily realized.

  Further, the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

The block diagram which shows the structure of the information processing apparatus which concerns on one Embodiment of this invention. 2 is an exemplary block diagram showing the relationship between hardware and software in the information processing apparatus of the embodiment. FIG. The figure for demonstrating the example of the virtual memory function used with the information processing apparatus of the embodiment. 4 is a diagram showing an example of memory allocation in the information processing apparatus of the embodiment. FIG. The figure which shows typically the shadow page table of the conventional virtual machine monitor. 3 is an exemplary view for explaining a memory management structure of a virtual machine monitor used in the information processing apparatus of the embodiment. FIG. 3 is an exemplary view for explaining an I / O request management structure of a virtual machine monitor used in the information processing apparatus of the embodiment. FIG. 6 is an exemplary view for explaining an update history management structure of a virtual machine monitor used in the information processing apparatus of the embodiment. FIG. 6 is an exemplary flowchart for explaining a part of the flow of page fault processing executed by the information processing apparatus of the embodiment; 6 is an exemplary flowchart for explaining the remaining part of the flow of page fault processing executed by the information processing apparatus of the embodiment; 6 is an exemplary flowchart for explaining the flow of general protection exception processing executed by the information processing apparatus of the embodiment; 6 is an exemplary flowchart for explaining a part of the flow of NMI processing when an ECC error is executed by the information processing apparatus of the embodiment; 6 is an exemplary flowchart for explaining the remaining part of the flow of NMI processing when an ECC error is executed by the information processing apparatus of the embodiment; 6 is an exemplary flowchart for explaining the flow of checkpoint acquisition processing executed by the information processing apparatus of the embodiment;

Explanation of symbols

  111 ... CPU, 112 ... memory management unit, 113 ... memory, 114 ... disk drive device, 115 ... I / O device, 200 ... virtual machine monitor, 301 ... memory area for guest OS1, 302 ... memory area for guest OS2 303: Memory area for guest OS3, 304: Memory area for virtual machine monitor (hypervisor), 305 ... Memory area for update history of guest OS1, 306 ... Memory area for update history of guest OS2, 307 ... Guest OS3 Update history memory area, 308... Memory area for failure replacement for guest OS1 to OS3.

Claims (10)

In an information processing apparatus that has a virtualization function and a virtual storage function and processes virtual storage of an operating system operating on a virtual environment in units of pages
Means for setting all pages of a page table corresponding to a memory area allocated to the operating system to a write-inhibited state by a virtual machine monitor that controls the virtual environment;
In response to a page write violation exception that occurs when the operating system refers to the page table to access a write protected page, the pre-update data of the page in which the page write violation has occurred is stored in the operating system. A pre-update data storage means for executing processing by the virtual machine monitor, which is obtained from the memory area and stored in the memory area managed by the virtual machine monitor;
Processing to continue writing to the page where the page write violation occurred by the operating system by releasing the write prohibition of the page where the page write violation occurred after saving the pre-update data, by the virtual machine monitor Means to perform,
Checkpoint acquisition means for periodically executing a checkpoint acquisition process and storing a context including a state of the processor of the information processing apparatus in a memory area corresponding to a predetermined virtual page address of the operating system;
When an exception due to the page write violation occurs, a process for determining whether or not the page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address, and a page in which the page write violation has occurred If it is determined that the page corresponds to the predetermined virtual page address, the page for which the write prohibition has been canceled is set to the write prohibition state again, and all pages of the page table assigned to the operating system are set to the write prohibition state An information processing apparatus comprising: means for executing a resetting process by the virtual machine monitor.   In order to delay execution of an I / O request issued from the operating system until the next checkpoint acquisition processing is executed, processing for accumulating I / O requests issued from the operating system, and page writing Means for executing, by the virtual machine monitor, processing for executing the stored I / O request when it is determined that the page in which the violation has occurred is a page corresponding to the predetermined virtual page address. The information processing apparatus according to claim 1, further comprising: Means for executing, by the virtual machine monitor, processing for determining whether or not the ECC error is an error correctable error when an ECC error occurs due to a memory access by the operating system;
If the ECC error is not an error correctable error, the state of the processor is restored to the state corresponding to the immediately preceding checkpoint using the saved context, and the saved pre-update data is used to restore the processor state. A process of restoring the memory state of the operating system to the time corresponding to the immediately preceding checkpoint, and a predetermined physical page is allocated to the virtual page address where the error that is not error-correctable occurs, and the error that is not error-correctable Further comprising: means for executing, by the virtual machine monitor, a process of setting a physical page address of the predetermined physical page in an entry of the page table corresponding to the virtual page address where the virtual machine address has occurred. Item 6. The information processing apparatus according to Item 1. Means for executing, by the virtual machine monitor, processing for setting the page table to a state in which a page corresponding to a virtual page address that calls a panic function of the operating system does not exist;
When an exception due to a page fault occurs, a process for determining whether or not the page where the exception due to the page fault occurs is a page corresponding to a virtual page address that calls the panic function code, and a code for the panic function If the page corresponds to the virtual page address to be called, the state of the processor is restored to the state corresponding to the immediately preceding checkpoint using the saved context, and the saved pre-update data is used to restore the processor state. 3. The information processing apparatus according to claim 2, further comprising means for executing, by the virtual machine monitor, processing for restoring the memory state of the operating system to a time point corresponding to the immediately preceding checkpoint. A failure recovery processing method for recovering an information processing apparatus having a virtualization function and a virtual storage function from a failure,
Executing by the virtual machine monitor controlling the virtual environment the setting process for setting all pages of the page table corresponding to the memory area allocated to the operating system operating in the virtual environment controlled by the virtual machine monitor to the write-inhibited state; ,
In response to a page write violation exception that occurs when the operating system refers to the page table to access a write protected page, the pre-update data of the page in which the page write violation has occurred is stored in the operating system. A process of acquiring from a memory area and storing in a memory area managed by the virtual machine monitor by the virtual machine monitor;
Processing to continue writing to the page where the page write violation occurred by the operating system by releasing the write prohibition of the page where the page write violation occurred after saving the pre-update data, by the virtual machine monitor Steps to perform;
A checkpoint acquisition step of periodically executing a checkpoint acquisition process and storing a context including a state of the processor of the information processing apparatus in a memory area corresponding to a predetermined virtual page address of the operating system;
When an exception due to the page write violation occurs, a process for determining whether or not the page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address, and a page in which the page write violation has occurred If it is determined that the page corresponds to the predetermined virtual page address, the page for which the write prohibition has been canceled is set to the write prohibition state again, and all pages of the page table assigned to the operating system are set to the write prohibition state. And a step of executing the resetting process by the virtual machine monitor.   In order to delay execution of an I / O request issued from the operating system until the next checkpoint acquisition processing is executed, processing for accumulating I / O requests issued from the operating system, and page writing A step of executing, by the virtual machine monitor, processing for executing the stored I / O request when it is determined that the page in which the violation has occurred is a page corresponding to the predetermined virtual page address. The failure recovery processing method according to claim 5, further comprising: A program that functions as a virtual machine monitor that virtualizes hardware resources of a computer having a virtual storage function,
A procedure for setting all pages of a page table corresponding to a memory area allocated to an operating system operating in a virtual environment controlled by the virtual machine monitor to a write-inhibited state;
In response to a page write violation exception that occurs when the operating system refers to the page table to access a write protected page, the pre-update data of the page in which the page write violation has occurred is stored in the operating system. A pre-update data storage procedure for executing processing to be acquired from the memory area and stored in the memory area managed by the virtual machine monitor;
A procedure for executing processing to continue writing to the page where the page writing violation has occurred by the operating system by releasing the write prohibition of the page where the page writing violation has occurred after storing the pre-update data;
A determination procedure for determining whether or not the page in which the page write violation has occurred is a page corresponding to a predetermined virtual page address of the operating system when an exception due to the page write violation has occurred, the operating system Includes a task for periodically executing a checkpoint acquisition process and storing a context including a state of a processor of the information processing apparatus in a memory area corresponding to the predetermined virtual page address; and ,
When an exception due to the page write violation occurs, a procedure for determining whether the page where the page write violation occurred is a page corresponding to the predetermined virtual page address;
When it is determined that the page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address, the page that is released from the write prohibition is set to the write prohibition state again and assigned to the operating system A program for causing the computer to execute a procedure for resetting all pages of a table to a write-protected state. A procedure for accumulating I / O requests issued from the operating system in order to delay execution of I / O requests issued from the operating system until a next checkpoint acquisition process is executed;
Causing the computer to further execute a procedure for executing the stored I / O request when it is determined that the page in which the page write violation has occurred is a page corresponding to the predetermined virtual page address. The program according to claim 7. A procedure for determining whether or not the ECC error is an error correctable error when an ECC error occurs due to memory access by the operating system;
If the ECC error is not an error correctable error, the state of the processor is restored to the state corresponding to the immediately preceding checkpoint using the saved context, and the saved pre-update data is used to restore the processor state. Procedures to restore the operating system memory state to the time corresponding to the previous checkpoint;
A predetermined physical page is allocated to a virtual page address in which an error that is not error-correctable has occurred, and an entry in the page table corresponding to the virtual page address in which an error that is not error-correctable has occurred 8. The program according to claim 7, further causing the computer to execute a procedure for setting a physical page address. A procedure for executing, by the virtual machine monitor, processing for setting the page table to a state in which no page corresponding to a virtual page address that calls the panic function of the operating system exists;
When an exception due to a page fault occurs, a procedure for determining whether or not the page where the exception due to the page fault is a page corresponding to a virtual page address that calls the code of the panic function;
If the page corresponds to a virtual page address that calls the panic function code, the saved context is used to restore the processor state to the state corresponding to the previous checkpoint and the saved update 8. The program according to claim 7, further causing the computer to execute a procedure for restoring the state of the memory of the operating system to a time corresponding to the immediately preceding checkpoint using previous data.

Images